CVE-2026-47346: TYPO3 CMS - Broken Access Control in Form Framework
Problem Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts.
Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.
Credits TYPO3 CMS thanks Alexander Künzl for reporting this issue, and to TYPO3 core & security team members Oliver Hader and Benjamin Franzke for fixing it.
Resources TYPO3-CORE-SA-2026-008
Other sources
Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-formto a version that resolves this vulnerability.Fixed in 14.3.3 - Upgrade
Upgrade
composer/typo3/cms-formto a version that resolves this vulnerability.Fixed in 13.4.31 - Upgrade
Upgrade
composer/typo3/cms-formto a version that resolves this vulnerability.Fixed in 12.4.46 - Upgrade
Upgrade
composer/typo3/cms-formto a version that resolves this vulnerability.Fixed in 11.5.51 - Upgrade
Upgrade
composer/typo3/cms-formto a version that resolves this vulnerability.Fixed in 10.4.57 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 14.3.3 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 13.4.31 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 12.4.46 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 11.5.51 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 10.4.57
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47346?
CVE-2026-47346 has a high severity rating of 7.6 according to the CVSS v4.0 scoring system.
How do I fix CVE-2026-47346?
To mitigate CVE-2026-47346, ensure that file uploads adhere to strict extension rules and update to the latest version of TYPO3 that addresses this vulnerability.
What is the risk associated with CVE-2026-47346?
CVE-2026-47346 poses a risk as it allows unauthorized file uploads that could lead to arbitrary SQL execution and potential system compromise.
Who is affected by CVE-2026-47346?
CVE-2026-47346 affects backend users of TYPO3 CMS who have file write permissions.
What is broken access control in the context of CVE-2026-47346?
In CVE-2026-47346, broken access control refers to the failure of the Form Framework to properly restrict file uploads based on their extensions.